specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: HashiCorp
providerId: hashicorp
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Cloud
  - DevOps
  - Infrastructure
  - Platform
  - Rate Limiting
  - Quotas
  - Throttling
description: HashiCorp publishes rate limits primarily for HCP Terraform. The platform enforces
  ~30 requests/second per authenticated user (or per IP for unauthenticated requests) across most
  endpoints, with stricter ceilings on sensitive endpoints (SMS/2FA at 5/min, email-sending at
  10–100/min, certain account operations at 40/hour). Limits are scoped per user — multiple tokens
  cannot bypass the limit. Other HashiCorp products (Vault, Consul, Nomad, Boundary) enforce limits
  configured by the operator at deploy time.
sources:
  - https://developer.hashicorp.com/terraform/cloud-docs/api-docs
  - https://www.hashicorp.com/en/products/terraform/pricing
headers:
  limit: x-ratelimit-limit
  retryAfter: Retry-After
responseCodes:
  throttled: 429
  quotaExceeded: 429
  serviceUnavailable: 503
limits:
  - tier: all
    name: HCP Terraform — Default API rate
    scope: user-or-ip
    metric: requests_per_second
    limit: 30
    timeFrame: second
    applies:
      - HashiCorp Terraform
    notes: Applies to most HCP Terraform API endpoints, authenticated by user or by source IP for
      unauthenticated requests.
  - tier: all
    name: HCP Terraform — SMS / 2FA endpoints
    scope: user
    metric: requests_per_minute
    limit: 5
    timeFrame: minute
    applies:
      - HashiCorp Terraform
  - tier: all
    name: HCP Terraform — Email-sending endpoints
    scope: user
    metric: requests_per_minute
    limit: '10–100'
    timeFrame: minute
    applies:
      - HashiCorp Terraform
    notes: Per-endpoint variation; verify against the specific endpoint reference.
  - tier: all
    name: HCP Terraform — Account operations
    scope: user
    metric: requests_per_hour
    limit: 40
    timeFrame: hour
    applies:
      - HashiCorp Terraform
  - tier: self-managed
    name: Vault / Consul / Nomad / Boundary — Operator-configured
    scope: cluster
    metric: varies
    limit: configured by operator (see product docs)
    applies:
      - HashiCorp Vault
      - HashiCorp Consul
      - HashiCorp Nomad
      - HashiCorp Boundary
policies:
  - name: Per-User Scoping
    description: HCP Terraform rate limits are bound to the authenticated user — multiple API tokens
      issued to the same user share the limit.
  - name: Backoff Strategy
    description: On 429, clients should back off and retry with jitter. Retry-After is not
      universally documented; default to exponential backoff.
  - name: Sensitive Endpoint Throttling
    description: SMS/2FA, email, and account-mutation endpoints have stricter per-minute / per-hour
      ceilings than the default 30 rps.
  - name: Self-Managed Configurability
    description: For Vault, Consul, Nomad, and Boundary, request quotas and rate limits are
      configured by the cluster operator (e.g. Vault sys/quotas/rate-limit).
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com